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Abstract 

Almost all dependable systems use some form of redundancy in order to increase fault-tolerance. Very popular are the N- 
Modular Redundant (NMR) systems in which a majority voter chooses the voting output. However, elaborate systems require 
fault-tolerant voters which further give additional information besides the voting output, e.g., how many module outputs agree. 
Dynamically defining which set of inputs should be considered for voting is also crucial. Earlier we showed a practical imple¬ 
mentation of programmable NMR voters that self-report the voting outcome and do self-checks. Our voter design method uses 
a binary matrix with specific properties that enable easy scaling of the design regarding the number of voter inputs N. Thus, an 
automated construction of NMR systems is possible, given the basic module and arbitrary redundancy N. In this paper we present 
the mathematical aspects of the method, i.e., we analyze the properties of the matrix that characterizes the method. We give the 
characteristic polynomials of the properly and erroneously built matrices in their explicit forms. We further give their eigenvalues 
and corresponding eigenvectors, which reveal a lot of useful information about the system. At the end, we give relations between 
the voter outputs and eigenpairs. 


I. Introduction 

Widely used scheme for increasing system dependability is A'-Modular Redundancy (NMR). Fig. [T] presents an NMR system. 
The N identical modules Mo, Mi,..., Mjv-i fed with the same input z are expected to produce equal outputs xo, Xi,..., Xn-i- 
However, in a real system the modules are subject to faults that lead to differences in these outputs. Therefore, a decision 
maker D selects the final output of the system y. One of the most frequently used decision makers is the majority voter, where 
at least \N/2 + lj outputs of the N modules have to be equal. 



Fig. 1. NMR system 

Dependable systems employ some form of redundancy (time, space, information) which affect other system properties such as 
performance, power consumption or complexity (cost). A trade-off is therefore necessary. However, intelligent mechanisms may 
enable a dynamic trade-off, i.e., increase dependability and performance or lower power consumption on demand. Consider the 
dependable 4MR system depicted in Fig. [2] as an example. The system acquires information by four identical sensors measuring 
the same physical quantity. This information is further processed by four processors that output the results xq,Xi,X 2 and £ 3 . 

By observing the responses of the processors over a period of time, the system could differentiate between permanent and 
transient faults in the processor-sensor pairs. Thus, if the system detects a permanent fault in one of the processor-sensor pairs, 
it may decide to switch them off in order to save power. Furthermore, consider the following NMR on demand (NMROD) 
adaptive behavior. Normally, only two processor-sensor pairs are operating in a dual-modular redundant (DMR) fashion. The 
power supply is switched off for all other pairs. As long as the two results are equal, the output of voting is equal to the 
results and the operation is considered error-free. A single disagreement between the two operating pairs is a signal for the 
system to power up a third pair and restart the operation in a triple-modular redundant (TMR) fashion. The fourth pair could 
be included only in critical situation when faults frequently occur, otherwise the system may opt switching back to DMR. 
















2 



Fig. 2. Dependable 4MR system 


Besides the output of voting y, these example systems have to know exactly which processor-sensor pairs disagree, as well 
as the total number of pairs that disagree. Furthermore, they require dynamically building 1MR to NMR systems with any 
possible combination of processor-sensor pairs. In this discussion we have assumed that the voter itself is not subject to faults. 
However, system operation is compromised if a fault occurs in the voter. Therefore, it is preferable to have some dependability 
mechanisms which detect and report incorrect voter operation, or if possible, mask the errors. 

So far we have illustrated our motivation for a special type of decision maker - a programmable NMR voter with self-report 
and self-checking capabilities that is suitable for all the scenarios discussed previously. These voters describe the situation 
at their inputs, e.g., which modules disagree. Moreover, they could be dynamically programmed in order to form different 
NMR systems on the fly. In m we show an intuitive method for designing such type of voters as well as the results from 
their actual implementation. Furthermore, we use these voters in order to investigate a dynamic scheme of core-level NMR in 
multiprocessors a. In this paper, we present the theoretical aspects of the method and we formally prove our assumptions. 
This is important since the method enables automated construction of elaborate NMR systems. That is, given the basic module 
(e.g., a single processor-sensor pair) and arbitrary redundancy N, the whole system could be built automatically. We present 
technical details of a register-transfer level NMR system generator in 01 . 

The rest of the paper is organized as follows. Section [II] presents related work. In Section III we give a complete formal 
specification of our voters as well as some basic definitions that we use in the following Sections. We describe the method in 
Section IV and give its formal description and proofs of properties in Section [V] The conclusion is in Section VI 


II. Related work 

A totally self-checking TMR system with concurrent error location capability is presented in E). The system determines 
whether an error occurred during voting as well as its location. The error coverage is 100%, i.e., the error can be detected in 
the redundant modules, the voter, or the error-checking circuit. The work is compared to a similar scheme proposed in 0 . Yet 
another technique for increasing the reliability of NMR voters based on error correction by Alternate-Data Retry is introduced 
in (6). 

While the focus in S), 0 and 0 is locating the error by using special circuits that observe the outputs of the redundant 
modules and the voter, our primary target is establishing a design method for programmable NMR voters which besides self¬ 
checks, output additional information for the state of their inputs. In particular, here we pay special attention to the mathematical 
analysis of this method in order to confirm its validity and importance, and enhance its capabilities. 

Design of a reconfigurable NMR system is introduced in (7). The design method enables scalability regarding the number of 
redundant modules N and adaptability. Moreover, the authors in 0 present a strategy for automated generation of redundant 
modules and a corresponding majority voter. On the other side, the method that we present here enables not only simple but 
also elaborate NMR system generation (such as dynamic NMROD), using special NMR voters. 

Dependability and performance analyses of NMR systems are given in 0 , na mi, while dependability modeling of 
NMROD systems is found in lfl2l . lfj~3l . 


III. Basic definitions and voter specification 

An NMR system is practically determined by the properties and characteristics of the decision maker. As said, the most 
freqently used decision makers are various types of voters. We first give some basic definitions and make a short voter 
classification in order to set the frame for the following Sections. Then, we specify our type of voter. 

Let the set of inputs of an NMR voter be A = { .x'o , Xi, .. ., xjv— i}. The absolute difference between the input values x, and 
Xj wil be denoted by Sjj , i.e. Sjj = \xj — Xi\. Exact voting algorithms consider x,; and Xj equal only if S tJ = 0, while inexact 
voting algorithms allow defining a a parameter and consider x, and x 3 equal if <5. tJ < a. At last, approved voting algorithms 
define a set or range of approved input values. The voter considers Xi and x :t equal if they belong to the defined set/range. 
A complete voter classification with in-depth analyses is given in tm Generally, the voters are marked by an M-o\xl-of-N 
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label denoting that voting is successful if there are at least M equal inputs of the N inputs in total. If M < N/2, ambiguous 
situations may occur since more than one input values could be legitimate candidates for the voting output. 

Although in this paper we mainly assume an exact 1 -out-of-A voter, the design method is general and could be applied for 
almost any voter type. Fig. [3] depicts our voter which reports its state and checks its own operation. 
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Fig. 3. Programmable NMR voter with self-report and self-checks 

The voting output y is equal to x. t , where is in the largest group of equal inputs. The d output gives the total number 
of inputs which differ from y. Equivalently, the voter could use an eq output, which gives the total number of inputs that are 
equal to the output of voting y. Outputs d, i = 0,1,... , N — 1 specify exactly which input Xi equals to y, i.e. e* = 1, 
if Xi = y, and e, = 0 if Xi ^ y. The a output signals ambiguous input situations where y could be equal to any of the 
legitimate candidates for the voting outputs. The err output signals an unsuccessful self-check. Actually, outputs d (or eq), 
e, , i = 0,1,..., N — 1, and a describe what is happening at the voter inputs. We refer to these outputs as the Input State 
Descriptor (ISD). 

Furthermore, the voter is programmable. Each of the Xi inputs could be dynamically programmed to be an active input, 
through a special signal pi. Each active input is included in the voting process, while all inactive inputs are excluded. This enables 
dynamically forming NMR systems (varying N) with any possible input combination. For example, defining pi = P 2 = active 
and po = P 3 = inactive in a 4MR system, transforms the system to a 2MR system taking into account only modules 1 and 2; 
modules 0 and 3 do not participate in the voting process; later, however, module 3 may be included - making a 3MR system. 
The programming signals imply two special configurations. Firstly, if no inputs are active, a OMR system is formed, which is 
illegal. In this situation, the voter outputs are undefined. Secondly, if only one input is defined as active (1MR system), y is 
always equal to the active input a;,. Thus, at least one input should be active for proper operation. 

At last, but not least important is that the method enables scaling. That is, the complete voter with interface as in Fig. [3] 
could be generated solely by specifying the N parameter. Furthermore, the design method is general in the sense that the 
specific implementation could be done either in hardware, software or any other technology. In JT) and m we show hardware 
and software realization, respectively. 


IV. Voter design method 

Our method is based on a binary matrix that reflects the equal inputs of the voter. The matrix enables determining the voting 
output and the ISD, and performing self-checks. 

A. Matrix construction 

Inherently, the set of voter inputs A might contain repeatable elements. Let A contain m < N different elements. If some 
element x £ A is repeated k times in A, then we say that the frequency of x in A is k (or simply, the frequency of x is k). 
Let /i, / 2 j ■ • •, fm are a H possible frequencies of the elements of A, then /i + fy + ... + f m = N. 

We construct the matrix A = [A 7J ] nxn, corresponding to the set A, as follows: 
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Aij — 


1 , 

0 , 


Xi = Xj 
7^ Ej ; 


i = o, iv — i 


(In the further text, we use the shorter notation i = 77 , 77 , to express an integer index range from 77 to 77 , with step 1. E.g., 
* = 0, N — 1 instead of i = 0,1,..., IV — 1.) 

By its definition, the matrix A is symmetric, with ones on its main diagonal. If all voter inputs are different one from each 
other than A equals the identity matrix. In the opposite case, if all voter inputs are the same, than all matrix elements are ones. 
Additionally, the matrix A represents the relation “=”, defined on the set A. As such, the matrix A represents equivalence 
relation (that is, reflexive, symmetric and transitive). 


Example 1. Let N = 4, Xo = 20, X\ = 30, x% = 20, X 3 = 10, and all inputs are active (pi = 1). The set A = {20,30, 20,10} 
has three different elements (m = 3); their frequencies are 2,1,1. The corresponding matrix would be: 

'10 10 ' 

0 1 0 0 

A ~ 1010 ' 

0 0 0 1 


The voter has additional N input signals that define which of its inputs are active, thus dynamically setting the voter as 
2MR, 3MR, ..., NMR voter. The question is, how is this reflected into the A matrix. We consider each inactive input 27 to 
be different from all other inputs Xj, j 7 ^ i. Thus, A t j = Aji = 0, Vj 7 ^ i and An = 1. 


B. Construction of ISD 

Taking into consideration that the matrix A is symmetric, with main diagonal of ones, all information about the input state 
can be obtained from the elements above (or below) its main diagonal i.e., the elements A r j. i = 0, N — 2, j = i + 1, N — 1. 
The elements of the matrix above the main diagonal from Example [I] are: 


0 1 0 
0 0 
0 


By simply filling the missing 


(N — 1)(N — 2) 


places with zeros (in the present case there are 6 such places, since N = 4), 


we get a reduced (N — 1 ) x (N — 1 ) matrix: 


An = 


where we preserve the enumeration of rows and columns (i = 0, N — 2 and j = i + 1, N — 1) as in the A matrix for the 
elements above the main diagonal. 

Now the ISD (signals d, e t and a) could be simply determined as follows. 


d= min |{Ay |A^ = 0, j = i + 1, N - 1}|, (1) 

where the notation |A| is used for the cardinality of a given set X. Actually, to find d, we search all (incomplete) rows, 
i = 0,N — 2, j = i + l,N— 1, of the A^ matrix, to find a row i = /, with the smallest number of zeros; then d = 
\{Ajj\Ajj = 0, j = i + 1 ,N — 1}| and eq = N — d. We assign y = xi, ej = 1 for j = I and Cj = 0, for j < I. Passing 
through columns j = I + 1, N — lof row I we determine e :l , for j > I, with ej = Ajj. The ambiguous signal a is set to 1 
if more than one (incomplete) row with the same, smallest number of zeros are encountered, otherwise a = 0. 

For instance, the smallest number of zeros in Example [I] is in row i = 0. Thus, y = x 0 = 20, d = 2 (two zeros in row 
i = 0), eq = 2, eo = 1. Passing through row 0 we determine ej for j > 0 : ei = A 01 = 0, e 2 = A 02 = 1, = A 03 = 0, i.e., 
we distinguish which inputs are equal to the output of voting y. The ambiguous signal is zero (a = 0) since we have a single 
row in the matrix with the smallest number of zeros. 

Probing many examples (with many variations of input sets) we observed that eq is exactly equal to the largest eigenvalue of 
the A matrix and that all other eigenvalues are integers. The question is, does this property hold in general, and, is it possible 
to prove it? 
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C. Construction of self-checks 

In our previous paper m self-check construction was based on violations of the transitivity property of the equivalence 
relation represented by the matrix A. More precisely, it was based on the misrepresentation in the matrix A (consequently in 
the matrix A r) of the following obvious property of the relation “=” defined on the set of voter inputs. 


if Xi = Xj A Xj = Xk 


then Xi = Xk- 


( 2 ) 


Example 2. For N 


Suppose that Ar \2 


4, X 0 = X! = X 2 7 ^ x 3 


A 12 is set to 0 instead of 1 . 


A R = 


1 

0 

0 


That is A 12 


1 0 
1 0 
0 0 

= A 21 


0, respectively. The matrices would become 



■ 1 

1 

0 ' 


II 

< 

0 

0 

0 

II 

< 


0 

0 

0 



1 1 0 
1 0 0 
0 10 
0 0 1 


Here, it is obvious that in the matrix representation of the method, the transitivity is violated. The A matrix simultaneously 
states that Xq = X\, and Xq = X 2 , but also that x\ 7 ^ X 2 - 


When the transitivity is violated as described in the example [2j we say that the matrix is erroneously built. Erroneously 
built matrices indicate one or more such errors in voting. The voter could use these matrices to do self-checks. For instance, 
the voter could check if transitivity ([ 2 ]) is satisfied for each i = 0. N — 2 of the Ar matrix, and each j and k where j > i and 
k > j. If the self-check passes, then err = 0 else err = 1. Nevertheless, this simple check of transitivity violation does not 
mean that the voter is 100% operating correctly. It only tells if an error is present in the matrix information or not. In other 
words, errors in the voter parts that later use the matrix information may not be caught without additional checks. 

As we did for properly built matrices, here too, we examined the eigenvalues of erroneously built matrices. In this case, all 
experiments indicated that they always have a non-integer eigenvalue. Thus, a challenge to deeply analyze the basic matrix 
upon which our method is built, was posed. 


V. Theoretical aspects 

In this Section we give proofs of assertions that were stated intuitively in Q] and state and prove new assertions related 
to the matrix.The Section is divided into three Subsections which treat the properties of a properly and an erroneously built 
matrix, as well as the relations of the characteristics of these matrices with the voter outputs. 

A. Characteristics of a properly built matrix 

Some of the obvious properties of the properly built matrix A were stated right after its definition. Another straightforward 
property is that the matrix has only real eigenvalues, since it is real symmetric and therefore Hermitian. We found that the 
eigenvalues and eigenvectors of the A matrix give a lot of information about the NMR voter. 

Recall that fi, f 2 , ■ ■ • > fm are all possible frequencies of the elements of A. Generality is preserved if fi > /2 > ... > / m . 
The following property serves as a basis for deriving the next few properties. 

Property 1. The A matrix is similar to the block - matrix A = diag{\f 11 1/ 2 ,..., l/ m }, where \f i is fi x /, matrix whose 
elements are all ones. 

Proof: The A matrix is similar to the A matrix, by the similarity transformation P, where P is a product of a finite 
number of permutation matrices. ■ 

Note that the matrix A represents the same set of voter inputs, but with reordered elements. The elements are listed such that 
the set starts with the same elements with highest frequency, followed by the same elements with non-increasing frequencies. 

Example 3. For the matrix from Example [7] we have: 


' 1 

1 

0 

0 ' 


' 1 

0 

1 

0 ' 

1 

1 

0 

0 

T~» — 1 

0 

1 

0 

0 

0 

0 

1 

0 

= P12 * 

1 

0 

1 

0 

0 

0 

0 

1 


0 

0 

0 

1 













where 


Pl2 = Pis' = 


10 0 0 
0 0 10 
0 10 0 
0 0 0 1 


A = Pr 2 i AP 12 . 


Here, the permutation matrix Pi 2 is obtained from 4x4 identity matrix, by interchanging 1-st and 2-nd row. Multiplication 
Pj, 1 ■ A interchanges 1-st and 2-nd rows of A. and multiplication by P 12 interchanges 1-st and 2-nd column of Pf 2 • A. In 
this way, we get the block - matrix A, with blocks of ones on the main diagonal, with sizes 2x2, lxl and lxl. The sizes 
of the blocks are exactly equal to the frequencies of the elements of A. 


It is easy to see (according to the Sylvester criterion) that A is positive semi-definite. So is the A matrix HE which implies 
that their eigenvalues are non-negative. So far, we know that the eigenvalues of A are non-negative reals. The following 
properties reveal, step-by step, the whole spectrum of A. 

Let <t(A) and p{ A) denote the spectrum and spectral radius of A, respectively. 


Property 2. 0 £ cr(A). 

Proof: Two similar matrices have the same determinant, thus 

det A = det A = det 1 p ■ det l/ 2 •... • det l/ m =0. 

The relation det A = 0 implies that 0 is an eigenvalue of A. ■ 


Property 3. p( A) = fi. Moreover, p( A) £ cr(A), i.e., the largest frequency of the elements of A is an eigenvalue of A. 

Proof: (This proof is different than the one given in (TJ.) As concluded before, all of the eigenvalues of A, A*, 1 < i < N 
are non-negative, so its spectral radius 

p( A) = max I Ajl = max A i. (3) 

i=l,2,... 1 i=l,2,... ,N 

The inequality 

P(A)<||A|| (4) 

holds for every norm of A (DU, p. 497). If we choose || ■ ||i - norm, then we obtain 

p(A) < ||A||i =max^|Ai j | =/i, (5) 

l ZJ 

3 

since the largest absolute row sum in A is /i. 

On the other hand, fi is an eigenvalue of A, since for the N - dimensional vector 

yi = [ 1 1 ... 1 0 0 ... 0] 

fl 

the equality 

Ayr = /iyi 

is satisfied. (We use the fact that the similar matrices A and A have the same eigenvalues.) 

Taking into account the fact that fi is an eigenvalue of A, and the relations ([3]) and (|5j, we conclude that the maximal 
eigenvalue of A is fi = p{ A). ■ 


Property 4. All frequencies of the elements of A are eigenvalues of the A matrix. 

Proof: It is enough to show that / 2 , / 3 ,..., f m are eigenvalues of the A matrix. 
For i = 2. 3,.... rn, we define iV-dimensional vectors y, with 

y * = [0 0 0 0 0 0 1 1.1 1 0 ... 0 ] T . 

/l+/2 + ---+/i-l fi 

It is easy to check that 

Ay* = fiYi, i = 2,m. 
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The proofs of Properties]^] and [f] contain explicit formulas of the eigenvectors of A, that correspond to the eigenvalues of 
A, i.e., the eigenpairs of A are (/,. y,), i = 1. m. What about the eigenpairs of A? Of course, the eigenvalues are the same. 
We denote the eigenvectors of A corresponding to the eigenvalues /i, f 2 , ■ ■ ■, / TO , by y-'* and give their description in the 
following property. 


Property 5. The eigenvectors of A, y**, are 0-1 N-dimensional vectors with ones at the positions that coincide with the 
positions of the elements with frequency fi of the set A. 


Proof: It can be easily checked that 


i.e., both vectors. Ay-” and /. i y7», 
zeros. 


Ay 7, = fcy fi , 

have fi- s at the positions of the elements with frequency f,. All other components are 


For the sake of clarity, we give the eigenvector y? 1 in its explicit form. Since f i is a frequency of some element of A, there 
exist ki,k 2 , ■ ■ ■, k^ £ {0,1,..., N — 1}, k\ < k 2 < ■ ■ ■ < kf ± such that 


%ki — — • • • — *£/c/i • 

The components of the vector y? 1 are 

fi _ / 1) * ki, k 2 ,..., kf x 

\ 0, otherwise 

and the components of the vector Ay f l = f \ y ^ are 

[AyA] < = /^> * = ki,k 2 ,...,k fl _ 

1 J \ 0, otherwise 

In general, the eigenvector y-' ,: gives information about the ordinal numbers of the elements (inputs) that have frequency f t . 
At those positions y -' 1 has ones. Other elements of y-'* are zeros. 

Remark: Note that the rows (columns) of A are its eigenvectors. 


Example 4. For the matrix from the Example [ 7 ] f-[ = 2, f 2 = f 3 = 1, p{ A) = 2 = f±. The eigenpairs of A for the frequencies 
/i, f 2 j fs are: (2,yi = [110 0] T ), (l,y 2 = [001 0] T ), and (l,y 3 = [0 0 0 1] T ). The eigenpairs of A for the frequencies 
/ti/ 2,/3 cire: (2. yk =[101 0] T ), (l,y^ 2 = [010 0] T ), and (l,y-^ 3 = [0 0 0 1] T ), from which we read the information 
that xq = x 2 is an element with frequency fi = 2, a;i and x$ are elements with frequencies f 2 = /a = 1. 


So far we showed that all frequencies of the elements of A and zero are eigenvalues of A. The question is, whether A has 
some other eigenvalues? Before answering this question (the answer is actually the property [6]) we will compute the n x n 
determinants D n (s) and F n (s) defined for n € N and s £ R, by 


D n (s) = 


s 

-1 

-1 

-1 ., 

.. -1 

-1 

s 

-1 

-1 .. 

. -1 

-1 

-1 

s 

-1 ., 

.. -1 

-1 

-1 

-1 

-1 .. 

s 


and 


( 6 ) 


F n (s) = 


We claim that 

D n (s) = (s + 1)" 1 (s — n + 1), 
Fn(s) = -( S +ir- 1 . 

By cofactor expansion of both determinants along their first row, we get: 

D n (s) = sB„_i(s) + (n - l)F n „i(s), 
F n (s ) = —D n —i(s) + (n - l)i 7 ’ n _i(s). 


-1 

-1 

-1 

-1 . 

. -1 


-1 

s 

-1 

-1 .. 

. -1 


-1 

-1 

s 

-1 . 

. -1 

(7) 

-1 

-1 

-1 

-1 . 

s 



( 8 ) 

(9) 

( 10 ) 

(ID 
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For n = 1, D\ = s and F\ = — 1, which corresponds to the formulas. Assuming that ([8]) and <0 hold for n £ N and taking 
into account © and (jTTJ, we obtain: 


D n+1 (s) = sD n (s) + nF n (s) = 

= s(s + l)™ _1 (s — n + 1) — n(s + l) ra_1 = 
= (s + l) n (s — ri), 

F n+1 (s) = —D n (s) + nF n (s) = 

= — (s + l) n_1 (s — n + 1) — n(s + 1)" _1 = 

= -(* + !)”, 


which, by means of mathematical induction, proves the formulas ([8]) and 421 - 


Property 6. <7(A) = {0, fi, / 2 ,.. •, /m}> t.e., the spectrum of A matrix consists of 0 and all frequencies of the elements of 

A. 


Proof: We use the notation (AI — 1)^ to indicate /) x /) matrix 



' A- 1 

-1 

t—1 

-1 . 

-1 


-1 

A- 1 

-1 

-1 . 

-1 

(AI - 1)/, = 

-1 

-1 

A- 1 

-1 . 

-1 


-1 

-1 

-1 

-1 . 

. A- 1 


( 12 ) 


The AI — A matrix is a block-diagonal matrix, consisting of to blocks of sizes /,; x f, (i = 1 , to), of type (12 1 . We give the 
characteristic polynomial of the A, i.e. A matrix, in its explicit form, using the formulas ji} and ^ (substituting s = A — 1, 

n = fi,i = 1, to): 


c a (A) =det(AI- A) = 

= det(AI —1)/! • det(AI — 1 )/ 2 • • ■ ■ • det(AI — 1 )/ m = 

= D h { A - 1) • £> /a (A - 1) •... ■ 23/ m (A - 1) = 

= A^ 1_1 (A - A) • A^ 2_1 (A - / 2 ) • • ■ • • A /m-1 (A - f m ) = 

= A Ar - m (A_/ 1 )(A-/ 2 )...(A-/ m ). 


The explicit form of the characteristic polynomial of the properly built matrix does not only give information about the 
spectrum of the A matrix, but also for the algebraic multiplicity of each eigenvalue. The importance of this fact will be 
elaborated later. 


B. Characteristics of an erroneously built matrix 


In order to find the characteristic polynomial of the erroneously built matrix, we first define the n x n determinant Q n {s) 
(where n £ N and s € R) by: 


s 0 -1 -1 ... -1 

0 s -1 -1 ... -1 

Qn(s)= - 1 - 1 s “I “I 

-1 -1 -1 -1 ... s 


(13) 


Its value can be easily obtained by cofactor expansion along its first row, 

Qn(s') &F) n — l(s) T (77. 2)sT' n _2 (s) 5 t)r 

Qn(s) = s(s + l) n ^ 3 (s 2 + (-n + 3)s - n + 4). (14) 


Property 7. Let there exist three equal elements Xi = Xj = Xk E A. If the following holds for the entries of the A matrix: 

A-ij — -Aji — 1 — A-ik — -Aki A Ajk — 0 — Akj, (15) 









9 


then it has a characteristic polynomial of the type 

ca(A) = \ N m 2 (A — 1)(A 2 + (—fi + 1)A — fi + 2) • 
•(A - A) ■ ■ • (A - /,_!)(A - /, +1 )... (A - / m ). 


Proof: Note that, since there should exist at least three equal voter inputs to consider transitivity at all, the frequency fi 
should be greater or equal to three. Let the elements Xi = Xj = Xk have the frequency fi, fi £ {/i, f 2 , ■ ■ ■, fm,}- Let the A 
matrix be erroneously built, as described by ( fl~5| ). Then, there exists a P matrix such that A = P 1 ■ A • P, where P is a 
product of a finite number of permutation matrices, A = diag{lf 1 , l/ 2 ,..., 1 f l _ 1 , Q, 1/ 1+1 ,..., l/ m } and Q is the fi x fi 
matrix 


Q 


10 11 
0 111 
1111 


1 

1 

1 


1 1 1 1 ... 1 


Then the matrix AI — A is a block-diagonal matrix consisting of blocks 
the fi x fi block AI — Q. Thus, the characteristic polynomial of A is: 


of type (12 1 for all /,; G {/i, / 2 , ■ ■ •, fm} \ {/;}, and 


c a (A) = det(AI - A) = 

= det(AI — l)/j ■ det(AI — l)/ 2 •... • det(AI — 1) f l _ 1 
■ det(AI — Q) • det(AI — 1) j l+1 •... • det(AI — 1 )/ m = 
= Eft (A — 1) • Df 2 (A — 1) • ... • Df l _ 1 (A — 1) • 

'Qfi (A - 1) • Df l+1 (A - 1) •... • D fm (\ - 1). 


Using ^ and (14 1 (with substitutions s = A — 1, and n = fi, 


i = 1, to) we obtain: 


ca(A) — X N m 2 (A — 1)(A“ + {—fi + 1)A — f + 2) ■ 
•(A — /i)... (A — fi-i){\ — f l+ i) ... (A — f m ). 


Corollary 1. If the A matrix is erroneously built, then it has two non-integer eigenvalues. 

Proof: The roots of the characteristic polynomial are 1, all frequencies except J) , then 0 (if N — m > 2), and the scalars 

, fi- 1 ± Vf? + 2/1-7 
Ai / 2 = -2-' 

The last eigenvalues are non-integers, since yjff + 2fi — 7 is non-integer for fi > 3. We certify this with the inequality 

fl < fi + 2/; — 7 < {fi + l) 2 , 

that holds for fi > 4, and ff + 2 fi — 7 = 8, for /; = 3. ■ 

Corollary |T] shows another way to the voter how to do self-checks. Another useful fact in this direction is that the zero 
eigenvalue has algebraic multiplicity A —to —2 for an erroneously built matrix, opposed to the algebraic multiplicity N — m for 
a properly built matrix. Similarly, for a properly built matrix, the eigenvalue 1 has algebraic multiplicity equal to the number 
of inputs with frequency 1 (including inactive inputs). For an erroneously built matrix, the algebraic multiplicity of 1 is bigger 
than this number for 1. 


Example 5. If xq = x 1 = 13/12 (A = 4, to = 2, /1 = 3,/2 = 1) and the corresponding matrix B is erroneously built, 


B = 


(the matrix implies that Xq = X\,X\ = x^,Xq X 3 ), then 


110 0 
110 1 
0 0 10 
0 10 1 


B = 


10 10 
0 110 
1110 
0 0 0 1 


= P 2 -3 1 Pr 3 1 APi 3 P23 
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and 

cb(A) = (A-1) 2 (A 2 —2A-1). 

The eigenvalues are Ai = 1 (since = 1), A 2 = 1 (since 1 is always an eigenvalue of an erroneously built matrix, see 
PropertyWV and two non-integer eigenvalues A 3/4 = 1 ± \/2. 


Example 6 . If xq = x\ = *2 = £3 (N = 4, m = 1, fi = 4) and the corresponding matrix B is erroneously built, 

1 


B = 


(the matrix implies that x 0 = X 2 ,X 2 = x$,Xo 7 ^ x 3 ), then 


B = 


= P^AP 


13 


and 


cb(A) = A(A-l)(A 2 -3A-2). 


The eigenvalues are Ai = 1, with algebraic multiplicity 1; X 2 = 0, with algebraic multiplicity N — m — 2 = 4— 1 — 2 = 1 
and two simple non-integer eigenvalues A 3/4 = . 


C. Matrix - voter outputs relationship 

At the end, we give the relations between the voter outputs (if the input set is A) and the scalar characteristic of a properly 
built matrix A corresponding to the set A. The output y is actually the element x^ = Xk 2 = ... = Xk f (recall the comment 
after Property [ 5 }; cq = f \ - the largest eigenvalue of A\ d = N — f \; e, are the components of the vector yA ; the ambiguous 
signal a = 0, if /1 is simple eigenvalue and a = 1 if algmultA.(fi) > 1. err = 1 if there is a non-integer eigenvalue of A, 
and err = 0 if all eigenvalues are non-negative integers. 

In other words, the eigenvalues of A answer the questions like “What are the frequencies of the inputs?”, “What is the 
output of the voter?” or “Is the matrix erroneously built?”. The corresponding eigenvectors answer the question “What are 
the positions of the equal inputs (with the corresponding frequency)?”. The multiplicity of the largest eigenvalue answers the 
question “Is there an ambiguity between the inputs?”. Examples [7] and [ 8 ] illustrate these issues. 

Example 7. For the B matrix from Example ^(because of its non-integer eigenvalues), the value of the error signal is 1, 
err = 1. If it was properly built, 

'110 1' 

1101 
0 0 10’ 

110 1 

c b (A) = A 2 (A — 1)(A — 3) 

to fi = 3 and f 2 = 1, are y? 1 = [1101] and y? 2 = [0010]. We obtain: 
fi — 3; 

n - h = i; 

Xq = X\ = X 3 (we read from y-' 1 ); 

1 = ei = e 3 ; 

0; 

0 , since alg multjy(fi) = 1; 

0. 


then 

and the eigenvectors of B matrix corresponding 

eq = 
d = 

y = 
eo = 
&2 = 
a = 


err 
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Example 8 . If xq = 20 x% X\ = X 3 = 30, then the corresponding matrix is 


Its characteristic polynomial is 


D = 


10 10 
0 10 1 
10 10 
0 10 1 


cd(A) = A 2 (A-2) 2 , 


which means that its eigenvalues are Ai = 2 and A 2 = 0. The eigenvectors corresponding to the frequency fi = /A = 2 are 
[1010] and [0 1 0 1], We obtain: 

eq = /1 = 2; 

d = N-f i=2; 

a = 1 , since algmultx{fi) = 2; 

2/ = £ 0 = a?i or y = Xi = cc 3 ; 

e 0 = 1 = e 2 , ei = 0 = e 3 , or, 

eo = 0 = e 2 , ei = 1 = e 3 ; 

err = 0. 

VI. Conclusion 


Outlining our motivation in Section [I] we gave several examples of sophisticated dependable NMR systems. They actually 
led us to a design method for programmable NMR voters that self-report their state and self-check their operation. The 
method is based on a binary matrix, which enables simplicity and scalability of the voter design. We got experimental results 
that foreshadowed interesting matrix properties, which in this paper were shown to be true by rigorous mathematical proofs. 
We characterized the design method through the most important matrix characteristics - the eigenvalues and eigenvectors. 
All exposed, theoretically-proven characteristics of the method enhance its possibilities in different applications. Although in 
hardware-realized NMR systems N is usually in the range from two to eight, in this paper we showed that the method is 
general and can be used to construct NMR systems for any natural number N. A software realization for large N is given 
in 05|. 
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